linux - Monitoring multiple lines in syslog to execute script - Stack Overflow

admin2025-04-29  2

Im trying to "fix" missing features in unifi switches, by disabling a port, "shutdown", for 5 minutes when it is disconnected.

Im monitoring syslog file, that receives syslog events from unifi switches. At the moment i am monitoring only one port for testing purposes. Is it possible to expand this command to monitor multiple ports?

#!/bin/bash
logfile="/home/user/scripts/mona43.$(date +%Y-%m-%d_%H%M).log"
exec 1>> >(ts '[%Y-%m-%d %H:%M:%S]' > "$logfile") 2>&1

echo "Starting monitoring Port 43"
tail -fn0 /var/log/syslog | \
while read line ; do
        echo "$line" | grep "USW-Pro-48-PoE-7.1.26+15869: switch: TRAPMGR: Link Down: 0/43"
        if [ $? = 0 ]
        then
        echo "Oh shit Port 43 is disconnected, disable port"
        /home/user/scripts/adminp43.sh
        echo "5 minutes timer starts, re-enabling Port 43 after that"
        sleep 5m
        /home/user/scripts/adminp43on.sh
    fi  
done

adminp43.sh and adminp43on.sh are just quick and dirty telnet commands thru ssh to shutdown and no shutdown port. Code works fine for one port.

Im novice when it comes to bash scripting, so im not sure if it is possible to add multiple lines to look for in tail, like echo "$line2" | grep "Different port", and then adding it to another if $line2 = 0 run another script. At the same time, and not lineary. Meaning that $line2 is not executed unless $line is found first and then is executed.

Im trying to "fix" missing features in unifi switches, by disabling a port, "shutdown", for 5 minutes when it is disconnected.

Im monitoring syslog file, that receives syslog events from unifi switches. At the moment i am monitoring only one port for testing purposes. Is it possible to expand this command to monitor multiple ports?

#!/bin/bash
logfile="/home/user/scripts/mona43.$(date +%Y-%m-%d_%H%M).log"
exec 1>> >(ts '[%Y-%m-%d %H:%M:%S]' > "$logfile") 2>&1

echo "Starting monitoring Port 43"
tail -fn0 /var/log/syslog | \
while read line ; do
        echo "$line" | grep "USW-Pro-48-PoE-7.1.26+15869: switch: TRAPMGR: Link Down: 0/43"
        if [ $? = 0 ]
        then
        echo "Oh shit Port 43 is disconnected, disable port"
        /home/user/scripts/adminp43.sh
        echo "5 minutes timer starts, re-enabling Port 43 after that"
        sleep 5m
        /home/user/scripts/adminp43on.sh
    fi  
done

adminp43.sh and adminp43on.sh are just quick and dirty telnet commands thru ssh to shutdown and no shutdown port. Code works fine for one port.

Im novice when it comes to bash scripting, so im not sure if it is possible to add multiple lines to look for in tail, like echo "$line2" | grep "Different port", and then adding it to another if $line2 = 0 run another script. At the same time, and not lineary. Meaning that $line2 is not executed unless $line is found first and then is executed.

Share Improve this question asked Jan 8 at 13:07 SmirnulfSmirnulf 312 bronze badges
Add a comment  | 

1 Answer 1

Reset to default 4

Stupid and simple - run in the background:

restart_port() {
        echo "Port $1 is disconnected, disable port"
        /home/user/scripts/adminp"${1}".sh
        (
            echo "5 minutes timer starts, re-enabling Port 43 after that"
            sleep 5m
           /home/user/scripts/adminp"${1}"on.sh
        ) &
}

tail -fn0 /var/log/syslog | while IFS= read -r line; do
        case "$line" in
        *"USW-Pro-48-PoE-7.1.26+15869: switch: TRAPMGR: Link Down: 0/43"*)
            restart_port 43
            ;;
        *"USW-Pro-48-PoE-7.1.26+15869: switch: TRAPMGR: Link Down: 0/XX"*)
            restart_port XX
            ;;
       esac
done

Overall, handling asynchronous events, like an event to do something after 5 minutes, is something known in programming. You can write a busy loop to poll for data, setup a timer to send a signal.

In the above code, it would be nice to protect against multiple executions of port resetting at the same time. For example, you can track child PIDs associated with ports, or create and check existence of some file, or flock some file. Or you could even use systemd-run as a scheduler and check existence of a job with a particular name, etc.

childs=()
pid_exists() { kill -0 "$1" 2>/dev/null; }
restart_port_locked() {
   if pid_exists "${childs[$1]}"; then
      echo "Restart of port $1 is already in progress... ignoring line"
   else
      restart_port "$1"
      childs[$1]=$!
   fi
}
  
转载请注明原文地址:http://anycun.com/QandA/1745856325a91287.html